Skip to content

Commit 77d5fa3

Browse files
vladpaiurazvancrainea
authored andcommitted
Disable TLS tickets for 1.2 and 1.3 in order to support reconnects after OpenSIPS restarts (#3673)
(cherry picked from commit 00305a4)
1 parent 70c07b9 commit 77d5fa3

1 file changed

Lines changed: 8 additions & 0 deletions

File tree

modules/tls_wolfssl/wolfssl_conn_ops.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,14 @@ int _wolfssl_tls_conn_init(struct tcp_connection* c,
199199
return -1;
200200
}
201201

202+
/* we are no managing TLS 1.2 or 1.3 tickets server side
203+
* so in case a client will want to reconnect after an OpenSIPS
204+
* restart, it will provide a pre-shared ticket and this re-connection
205+
* will just fail, so take the lazy way out and disable tickets
206+
* https://datatracker.ietf.org/doc/html/rfc8446#section-2.2 */
207+
wolfSSL_NoTicketTLSv12(_WOLFSSL_READ_SSL(c->extra_data));
208+
wolfSSL_no_ticket_TLSv13(_WOLFSSL_READ_SSL(c->extra_data));
209+
202210
/* put pointers to the tcp_connection and tls_domain structs
203211
* in the WOLFSSL struct as extra data */
204212
if (!wolfSSL_set_ex_data(_WOLFSSL_READ_SSL(c->extra_data),

0 commit comments

Comments
 (0)